twinmind-enterprise-rbac

TwinMind Enterprise RBAC

Contents

• Overview
• Prerequisites
• Instructions
• Output
• Error Handling
• Examples
• Resources

Overview

Enterprise-grade role-based access control for TwinMind with SSO/SAML integration, team management, resource-level authorization, and access audit logging.

Prerequisites

• TwinMind Enterprise account
• Admin access to TwinMind organization
• Identity provider (Okta, Azure AD, Google Workspace)
• Understanding of RBAC concepts

Instructions

Step 1: Define Roles and Permissions

Create Permission enum covering transcript, summary, action item, team, settings, billing, and admin permissions. Define role hierarchy: Viewer -> Member -> Manager -> Admin -> Owner with permission inheritance via resolvePermissions().

Step 2: Implement Permission Checking

Build AuthorizationService with hasPermission(), hasAnyPermission(), hasAllPermissions() methods. Support admin wildcard, explicit deny lists, and resource-level authorization (own transcripts vs all transcripts).

Step 3: Configure SSO/SAML Integration

Set up SAML strategy with passport-saml. Map IdP attributes (email, name, groups) to TwinMind users. Configure group-to-role mapping (e.g., "TwinMind-Admins" -> admin role).

Step 4: Team Management

Build TeamManager with create team, add/remove/invite members, role updates, and sync to TwinMind organization. Enforce permission checks on team operations.

Step 5: Access Audit Logging

Create AccessAuditLogger that records all access attempts (granted and denied) with user, action, resource, IP, and user agent. Send to SIEM if configured. Add Express middleware for automatic audit trail.

See detailed implementation for complete RBAC code including Permission enum, role definitions, SSO config, team management, and audit logging.

Output

• Role and permission definitions
• Permission checking service
• SSO/SAML configuration
• Team management functionality
• Access audit logging

Error Handling

Issue	Cause	Solution
SSO login failed	Certificate mismatch	Update IdP certificate
Role not syncing	SCIM misconfigured	Check provisioning setup
Permission denied	Wrong role assigned	Review role mapping
Audit gaps	Middleware not applied	Add to all routes

Examples

Basic usage: Apply twinmind enterprise rbac to a standard project setup with default configuration options.

Advanced scenario: Customize twinmind enterprise rbac for production environments with multiple constraints and team-specific requirements.

Resources

• TwinMind Enterprise
• SAML 2.0 Specification
• SCIM Protocol

Next Steps

For migration from other tools, see twinmind-migration-deep-dive.